Unsolved

This post is more than 5 years old

18 Posts

3076

January 10th, 2005 14:00

NTVDM has encountered an illegal instruction

Within moments, whenever I log into IE6, I encounter a Blank DOS screen (16 bit MS DOS Subsystem).
This is followed by an error message "NTVDM has encountered an illegal 
instruction, etc.....  "
 
I can always get out of the problem with the cancel button. I have also noticed that if I leave IE 
open for several hours, that the same message will come up again on a very exact timetable, as if though 
there is a scheduled activity taking place.  I have no scheduled activities in any of my applications.
I have taken the following steps to try and resolve the problem but have had no luck.
1. Ran a virus check
2. Ran Spy Sweeper
3. Reloaded IE6 
4. Reduced "START UP" and "Services" to a bare minimum
The problem still continued

I even installed Netscape 7 to try and isolate the problem.  Netscape ran OK, however as soon as I get back to IE the problem comes up again.
It is as if though IE is executing some background routine that is causing the problem.

I do not want to reload XP (Pro) as that would wipe out my system.

Help!!!

59 Posts

January 10th, 2005 15:00

 

Have you run SFC (System File Checker) from the Start > Run?  Have your Windows CD ready.  Also, what SP are you on?
 
SFC

/SCANNOW        Scans all protected system files immediately.
/SCANONCE       Scans all protected system files once at the next boot.
/SCANBOOT       Scans all protected system files at every boot.
/REVERT         Return scan to default setting.
/PURGECACHE     Purges the file cache.
/CACHESIZE=x    Sets the file cache size.
 

59 Posts

January 10th, 2005 19:00

No ignorence noted :) 

Here is a great article on SFC.  http://www.updatexp.com/scannow-sfc.html

18 Posts

January 10th, 2005 19:00

Mark,
 
I'm on SP1.
At the risk of showing some ignorance, when I try the recommended commands from the Start>Run command line, I keep getting messages that they can not be found.
Do I need to be at the Windows directory, or am I missing something ?
 
Thanks for your help!
 
 
 
 

59 Posts

January 11th, 2005 19:00

what is the rest of the "NTVDM has encountered an illegal
instruction, etc..." message?

18 Posts

January 11th, 2005 19:00

I tried the recommendedations, however nothing seems to work, as the problem continues to be there.

The only thing i can conclude is that there is a 16 bit application tied to the first time IE is used.  It does not matter what web site I start with, becuase the problem comes up within 30 seconds. 

Will continue to work the problem, as the reload of W/XP is the very, very, very last option.

18 Posts

January 12th, 2005 00:00

The message that comes out when the DOS sceen appears is:
 
C:\Documents and settings.........CS:0567IP:0096op:ff ff 73 73 2e choose Close to terminate the application
 
Where I have the ...., that is the path to my user directory within the Documents and Settings.
 
Appreciate your help.
 
Thanks! 

59 Posts

January 12th, 2005 14:00

Whoa.  I can't interpret that code.  A google search also was no help.  Can you update the service pack on your PC? 

18 Posts

January 12th, 2005 15:00

I tried to go tp SP2 but I encounterd an "access denied" what appeared to be half way through.  Then it backed itself out.
I did not have any other services other than the Norton Internet security application running (firewall and AV).
 
There was no indication where the access was denied.
 
This has me stumped!
 

4.4K Posts

January 12th, 2005 16:00

Jplum,

Are there any 16-bit browser extensions that serve a legitimate purpose any more? What happens if you disable third-party browser extensions (Advanced/Browsing under "Internet Options")?

Try checking the machine for spyware/malware using Ad-Aware and Spybot as described in this article.

(edit) Updated link to Ad-Aware/Spybot article.

Jim

Message Edited by jimw on 01-12-2005 11:26 AM

59 Posts

January 12th, 2005 16:00

1. Ran a virus check
2. Ran Spy Sweeper
3. Reloaded IE6
4. Reduced "START UP" and "Services" to a bare minimum
 
All right.  You did the above.  Could you please try spybot and ad-aware (make sure that they are fully up to date).  Then scan.  Once you are done, reboot into safe mode and scan again. 
 
===================================
Also search your pc for the following files:
 
KEYBOARD.DRV
command.com
Config.nt
Autoexec.nt
 
If any of these files are missing, then you have some spyware that hasn't been removed.
 
===============================================================

18 Posts

January 14th, 2005 00:00

Mark,
 
I truly appreciate your help.
I have tried everything that you have recommended, however the problem continues.
I don't know if there is any way I can set up a log entry to look at, so that I can trap the problem at the moment in time that it happens.
I'm afraid that without that level of detail, that the problem isolation is becoming hopeless.
The system is free of viruses and adware / spyware, so I don't know what else is left other than some stray application that I can't puut my finger on.  The only thing that is common is that when I first strat up IE, most of the time it will give me the error.
 
Thans for your help.
 
 

18 Posts

January 16th, 2005 14:00

Perhaps a clue.

In my \Windows\System32  directory I have the following executable in my Start Up.  No matter what I do I can not get rid of them, and I can not find any reference about them at Microsoft.

KWARKC.Exe

Also,  I get the following in my Start Up that points to my  \ Documents and Setting\All Users\Start Menue\Programs\Startup\nhgtni.exe

I can not find any info on this as well.

 

 

 

4.4K Posts

January 16th, 2005 16:00

Jplum,

The most frequent source of oddly-named executables is spyware/malware. I'd suggest checking your machine again. See my last post for information about obtaining Ad-Aware and Spybot.

Jim

18 Posts

January 16th, 2005 17:00

I did run all of the applications that were recommended.

These 2 executables I found as I started to did into it deeper.

Now I'm down to the less obvious.

4.4K Posts

January 17th, 2005 02:00

Jplum,

The less obvious ones tend to require expert help.

Download HijackThis, a malware analysis and removal tool, and submit the log it produces for analysis.

Here's an illustrated guide to installing and running HijackThis that you may find helpful.

Copy and paste the contents of the log you saved in a new message in the Virus/Spyware Information and Removal board. Be sure to describe the problem you're experiencing.

Jim
No Events found!

Top